diff --git a/lib/tasks/test.rb b/lib/tasks/test.rb
index 1432db81d1..51432e890a 100644
--- a/lib/tasks/test.rb
+++ b/lib/tasks/test.rb
@@ -54,6 +54,7 @@
     sh 'shellcheck -x nginx_stage/sbin/nginx_stage'
     sh 'shellcheck nginx_stage/sbin/update_nginx_stage'
     sh 'shellcheck hooks/k8s-bootstrap/*.sh'
+    sh 'shellcheck packaging/files/k8s_token_refresh'
   end
 
   begin
diff --git a/packaging/files/k8s_token_refresh b/packaging/files/k8s_token_refresh
new file mode 100755
index 0000000000..d3574c2fc3
--- /dev/null
+++ b/packaging/files/k8s_token_refresh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+set -e
+
+if command -v kubectl >/dev/null 2>&1;
+then
+  CMD_USER=$(whoami)
+  if [ "$CMD_USER" == "root" ]; then
+    TOKEN=$(kubectl create token ondemand --namespace=ondemand --duration 9h)
+    kubectl config set-credentials ondemand@kubernetes --token="$TOKEN"
+  else
+    >&2 echo "this program needs to run as 'root' and you are $CMD_USER."
+    exit 1
+  fi
+fi